


  
    

  
        
  
  
  
  


    <!DOCTYPE html>
<!--[if IE     7 ]><html lang="en" class="x ie ie7 en"><![endif]-->
<!--[if IE     8 ]><html lang="en" class="x ie ie8 en"><![endif]-->
<!--[if IE     9 ]><html lang="en" class="x ie ie9 en"><![endif]-->
<!--[if (gt IE 9)|!(IE)]><!--><html lang="en" class="x jsDisabled- en"><!--<![endif]-->
<head>

	<!-- COMMON_COUNTER_FIRST_ROW_HEAD -->
<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-5KXCVXZ');</script>
<!-- End Google Tag Manager -->
<!-- COMMON_COUNTER_FIRST_ROW_HEAD // -->
	<script src="//st.drweb.com/static/js/redir-https.js"></script>
	<script src="//st.drweb.com/static/js/acceptable_browsers_2018.js"></script>
	<script>
		(function() {
			var html = document.documentElement;
			html.className = html.className.replace( ' jsDisabled-', '' )
		}())
	</script>

	<title>Linux backdoor malware infects WordPress-based websites</title>

	<meta http-equiv="content-type" content="text/html; charset=utf-8"/>
	<!--[if IE]>
	<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
	<![endif]-->
	<meta name="viewport" content="width=device-width, height=device-height, maximum-scale=1.0, minimum-scale=1.0" />
	<meta name="description" content="Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites." />

	
	<meta property="og:type" content="website" />
	<meta property="og:site_name" content="Dr.Web" />
	<meta property="og:url" content="https://news.drweb.com/show/?i=14646&lng=en&c=23" />
	<meta property="og:title" content="Linux backdoor malware infects WordPress-based websites" />
	<meta property="og:description" content="Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites." />
	<meta property="og:image" content="https://st.drweb.com/static/new-www/favicons/og-drweb-default.jpg?r=1" />
	<meta property="og:image:width" content="968" />
	<meta property="og:image:height" content="504" />

			<!-- there is used META_DESCRIPTION (only meta tags) -->
	
	<!-- icons_full_package -->
	<link
		rel="shortcut icon" type="image/x-icon"
		href="//st.drweb.com/static/new-www/favicon.ico?r=2" />
	<link
		rel="apple-touch-icon" sizes="57x57"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-57x57.png" />
	<link
		rel="apple-touch-icon" sizes="60x60"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-60x60.png" />
	<link
		rel="apple-touch-icon" sizes="72x72"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-72x72.png" />
	<link
		rel="apple-touch-icon" sizes="76x76"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-76x76.png" />
	<link
		rel="apple-touch-icon" sizes="114x114"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-114x114.png" />
	<link
		rel="apple-touch-icon" sizes="120x120"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-120x120.png" />
	<link
		rel="apple-touch-icon" sizes="144x144"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-144x144.png" />
	<link
		rel="apple-touch-icon" sizes="152x152"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-152x152.png" />
	<!-- icons_modern_package -->
	<link
		rel="apple-touch-icon" sizes="180x180"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-180x180.png" />
	<link
		rel="icon" type="image/png" sizes="32x32"
		href="//st.drweb.com/static/new-www/favicons/favicon-32x32.png" />
	<link
		rel="icon" type="image/png" sizes="16x16"
		href="//st.drweb.com/static/new-www/favicons/favicon-16x16.png" />
	<link
		rel="manifest"
		href="//st.drweb.com/static/new-www/favicons/manifest.json" />
	<link
		rel="mask-icon" color="#2e2e2e"
		href="//st.drweb.com/static/new-www/favicons/safari-pinned-tab.svg" />

	<meta name="msapplication-TileColor" content="#7cb51b" />
	<meta name="msapplication-TileImage" content="//st.drweb.com/static/new-www/favicons/mstile-144x144.png" />
	<!-- Force theme color: -->
	<meta name="theme-color" content="#f2f2f2" />
	<!-- ! icons_modern_package -->
	<!-- ! icons_full_package -->

	<link rel="alternate" type="application/rss+xml" title="Dr.Web All News" href="https://news.drweb.com/rss/get/?c=5&amp;lng=en" />

	<!-- styles -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/drweb_user_login_widget_tile_mobi.css" />
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/css/tile-mobi-transition.css?r=24" />

	<!--[if lt IE 9]>
	<script>'svg use article section'.replace(/\w+/g,function(n){document.createElement(n)})</script>
	<style>svg,use{display:none;}</style>
	<![endif]-->

	<script src="//st.drweb.com/static/js/jquery-1.7.2.min.js"></script>
	<script src="//st.drweb.com/static/js/jquery.cookie.min.js"></script>
	<script src="//st.drweb.com/static/js/showit/showit.min.js"></script>
	<script src="//st.drweb.com/static/js/qdata/qdata.min.js"></script>
	<script src="//st.drweb.com/static/js/qdata/extensions/pi.js"></script>
	<script src="//st.drweb.com/static/js/switcher/switcher.min.js"></script>
	<script src="//st.drweb.com/static/js/scrollx/scrollx.min.js"></script>
	<script src="//st.drweb.com/static/js/scrollup_button.js"></script>
	<script src="//st.drweb.com/static/js/ec-events.js"></script>
	
	<!-- icons -->
	<script src="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/icons/jquery.icons.min.js?r=7"></script>
	<script>if( window.SvgIcons && SvgIcons.Rev ){ SvgIcons.Rev(5) }</script>
	<!-- popup -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/popup/css/tile.css" />
	<script src="//st.drweb.com/static/js/popup/popup.js"></script>
	<script>$(function(){$('a.preview').popUp({imgAutoResize:true});});</script>
	<!-- dyn-tree -->
	<script src="//st.drweb.com/static/js/dyn-tree/dyn-tree.js"></script>
	<!-- dyn-tree: data-dyn-mobi-menu -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/dyn-tree/extensions/data-dyn-mobi-menu.css" />
	<script src="//st.drweb.com/static/js/dyn-tree/extensions/data-dyn-mobi-menu.js"></script>
	<!-- lazy load -->
	<script src="//st.drweb.com/static/js/makelazy/makelazy.min.js"></script>
	<script>
		var Lazy = MakeLazy();
		$(function(){
			Lazy.Observe(false, '.CONTENT');
			$('.NAV-case.on_hover').one('mouseenter', function(){
				Lazy.Load(false, this);
			});
		});
	</script>
	<!-- cocss (last) -->
	<script src="//st.drweb.com/static/js/cocss/cocss.min.js"></script>

		<!-- theme/tile_mobi/main_resources.tt start -->

<script src="//st.drweb.com/static/js/jsurl/url.js"></script>
<script src="//st.drweb.com/static/js/change_lng_w_domains_v2.js"></script>
<script src="//st.drweb.com/static/js/old_browser_detection.js"></script>

<script src="//st.drweb.com/static/js/jquery.cookie.min.js" ></script>

<!--
<script src="//st.drweb.com/static/js/elephant/elephant.js?5"></script> 
<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/new-www/buy_elephant/css/buy_elephant_tile.css?1" />
-->

<!-- theme/tile_mobi/main_resources.tt end -->


    <link href="//st.drweb.com/static/new-www/themes/tiles/css/news_root_new.css" media="screen" rel="stylesheet" type="text/css"/>
    <link href="//st.drweb.com/static/new-www/themes/tiles/css/news_arrows_new.css" media="screen" rel="stylesheet" type="text/css"/>
    <script src="//st.drweb.com/static/new-www/themes/tiles/js/news_arrows_new.js" type="text/javascript"></script>
    <script src="//st.drweb.com/static/new-www/themes/tiles/js/news_extra_sharer_new.js" type="text/javascript" ></script>

    <link href="//st.drweb.com/static/js/highlight/default.min.css" rel="stylesheet">
    <script src="//st.drweb.com/static/js/highlight/highlight.min.js"></script>

    <script src="//st.drweb.com/static/new-www/additions.js" type="text/javascript"></script>

    
<script type="application/ld+json">
{
    "@context": "https://schema.org",
    "@type": "NewsArticle",
    "@id": "https://news.drweb.com/show/?i=14646",
    "mainEntityOfPage": "https://news.drweb.com/show/?i=14646",
    "headline": "Linux backdoor malware infects WordPress-based websites",
    "articleBody": "December 30, 2022 Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites. For many years cybercriminals have been attacking WordPress-driven websites. Information security experts register cases when various vulnerabilities of the WordPress platform are used in order to hack sites and inject malicious scripts into them. An analysis of an uncovered trojan application, performed by Doctor Webs’ specialists, revealed that it could be the malicious tool that cybercriminals have been using for more than three years to carry out such attacks and monetize the resale of traffic, or arbitrage. Dubbed Linux.BackDoor.WordPressExploit.1 in accordance with Dr.Web anti-virus classification, this malware targets 32-bit versions of Linux, but it can also run on 64-bit versions. Linux.BackDoor.WordPressExploit.1 is a backdoor that is remotely controlled by malicious actors. Upon their command, it is able to perform the following actions: Attack a specified webpage (website); Switch to standby mode; Shut itself down; Pause logging its actions. The main functionality of the trojan is to hack websites based on a WordPress CMS (Content Management System) and inject a malicious script into their webpages. To do so, it uses known vulnerabilities in WordPress plugins and website themes. Before attacking, the trojan contacts its C&amp;C server and receives the address of the site it is to infect. Next, Linux.BackDoor.WordPressExploit.1 successively tries exploiting vulnerabilities in the following outdated plugins and themes that can be installed on a website: WP Live Chat Support Plugin WordPress – Yuzo Related Posts Yellow Pencil Visual Theme Customizer Plugin Easysmtp WP GDPR Compliance Plugin Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972) Thim Core Google Code Inserter Total Donations Plugin Post Custom Templates Lite WP Quick Booking Manager Faceboor Live Chat by Zotabox Blog Designer WordPress Plugin WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233) WP-Matomo Integration (WP-Piwik) WordPress ND Shortcodes For Visual Composer WP Live Chat Coming Soon Page and Maintenance Mode Hybrid If one or more vulnerabilities are successfully exploited, the targeted page is injected with a malicious JavaScript that is downloaded from a remote server. With that, the injection is done in such a way that when the infected page is loaded, this JavaScript will be initiated first—regardless of the original contents of the page. At this point, whenever users click anywhere on the infected page, they will be transferred to the website the attackers need users to go to. An example of one of the infected pages is shown in the screenshot below: The trojan application collects statistics on its work. It tracks the overall number of websites attacked, every case of a vulnerability being exploited successfully, and additionally—the number of times it has successfully exploited the WordPress Ultimate FAQ plugin and the Facebook messenger from Zotabox. In addition, it informs the remote server about all detected unpatched vulnerabilities. Along with the current modification of this trojan application, our specialists also discovered its updated version Linux.BackDoor.WordPressExploit.2 . It differs from the original one by the C&amp;C server address, the address of the domain from which the malicious JavaScript is downloaded, and also by an additional list of exploited vulnerabilities for the following plugins: Brizy WordPress Plugin FV Flowplayer Video Player WooCommerce WordPress Coming Soon Page WordPress theme OneTone Simple Fields WordPress Plugin WordPress Delucks SEO plugin Poll, Survey, Form &amp; Quiz Maker by OpinionStage Social Metrics Tracker WPeMatico RSS Feed Fetcher Rich Reviews plugin With that, both trojan variants have been found to contain unimplemented functionality for hacking the administrator accounts of targeted websites through a brute-force attack—by applying known logins and passwords, using special vocabularies. It is possible that this functionality was present in earlier modifications, or, conversely, that attackers plan to use it for future versions of this malware. If such an option is implemented in newer versions of the backdoor, cybercriminals will even be able to successfully attack some of those websites that use current plugin versions with patched vulnerabilities. Doctor Web recommends that owners of WordPress-based websites keep all the components of the platform up-to-date, including third-party add-ons and themes, and also use strong and unique logins and passwords for their accounts. Indicators of compromise More details on Linux.BackDoor.WordPressExploit.1 More details on Linux.BackDoor.WordPressExploit.2 ",
    "image": "https://st.drweb.com/static/new-www/favicons/og-drweb-default.jpg",
    "author" : {
        "@type": "Organization",
        "name": "Doctor Web",
        "brand": "Dr.Web",
        "logo": {
            "@type": "ImageObject",
            "url": "https://st.drweb.com/static/new-www/images/logos/drweb_logo_wwwdrwebcom.png"
        }
    },
    "publisher": {
        "@type": "Organization",
        "name": "Doctor Web",
        "brand": "Dr.Web",
        "logo": {
            "@type": "ImageObject",
            "url": "https://st.drweb.com/static/new-www/images/logos/drweb_logo_wwwdrwebcom.png"
        }
    },
    "datePublished": "2022-12-30",
    "dateModified": "2022-12-30",
    "interactionStatistic": {
        "@type": "InteractionCounter",
        "interactionType": "https://schema.org/ReplyAction",
        "userInteractionCount": 0    }
}
</script>


          <link rel="canonical" href="https://news.drweb.com/show/?i=14646" />
    
                <link rel="alternate" href="https://news.drweb.ru/show/?i=14646" hreflang="ru" />
            <link rel="alternate" href="https://news.drweb.com/show/?i=14646" hreflang="en" />
            <link rel="alternate" href="https://news.drweb-av.by/show/?i=14646" hreflang="be" />
            <link rel="alternate" href="https://news.drweb.co.jp/show/?i=14646" hreflang="ja" />
            <link rel="alternate" href="https://news.drweb-av.es/show/?i=14646" hreflang="es" />
            <link rel="alternate" href="https://news.drweb-av.de/show/?i=14646" hreflang="de" />
            <link rel="alternate" href="https://news.drweb.uz/show/?i=14646" hreflang="uz" />
            <link rel="alternate" href="https://news.drweb.fr/show/?i=14646" hreflang="fr" />
            <link rel="alternate" href="https://news.drweb-av.it/show/?i=14646" hreflang="it" />
            <link rel="alternate" href="https://news.drweb.cn/show/?i=14646" hreflang="zh" />
            <link rel="alternate" href="https://news.drweb.kz/show/?i=14646" hreflang="kk" />
    
  
	
	<script>window['elephant_aj'] = {common:{preftpl:'showit_'}};</script>

	<!-- b4 sns -->
		<!-- after sns -->

	<!--review banners-->
	<link rel="stylesheet" href="//st.drweb.com/static/js/review_banners/style.css">
	<!--review banners-->

</head>

<body class="BODYBOX">

	<!-- COMMON_COUNTER_FIRST_ROW_BODY -->
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5KXCVXZ"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) -->
<!-- COMMON_COUNTER_FIRST_ROW_BODY // -->
	
		<!-- theme/tile_mobi/noscript.tt start -->

<noscript>
	<div class="JsDisabled">
		<strong>JavaScript support is required for our site to be fully operational in your browser.</strong>
	</div>
</noscript>

<!-- theme/tile_mobi/noscript.tt end -->

<!-- theme/tile_mobi/old_browser.tt start -->

<div class="OldBrowser" hidden>
	<p class="title"><strong class="noB"><a href="https://www.drweb.com/old_browser_info/" class="white">Your browser is obsolete!</a></strong></p>
<p class="note">The page may not load correctly.</p></div>

<!-- theme/tile_mobi/old_browser.tt end -->

<div class="HEAD clearfix">
<!-- theme/tile_mobi/head_pi.tt start -->



<div class="PI container container_cell ztop "
  data-swr-click-outside="hide"
  data-swr-group="header"
  data-swr-click="toggle">

  <div class="PI-wrp PI-wrp_head flex green-head">

    <div class="PI-group PI-group_head flex">
      <a class="PI-itm PI-itm_logo PI-group-itm js-data-dyn flex fxItemsCenter noU" href="https://www.drweb.com/?lng=en" data-dyn-mobi-menu="<i data-icon=&quot;#logo-drweb.icon_sizeS.icon_logo:size200x50&quot;></i>">
        <i class="Icon Icon_noEffects icon_sizeS icon_logo black logo-drweb">
          <svg class="Icon-cnt" width="200" height="50">
            <use xlink:href="#logo-drweb"></use>
          </svg>
        </i>
              </a>
  
      <div class="PI-group-itm PI-group-itm_other flex fxItemsCenter">
        <div class="PI-itm PI-itm_other" data-swr-target="protecting">
          <a class="Btn Btn_clean black _viewL_white" data-swr="protecting" data-swr-class-active="-Icon_rotate180" href="#">
            <p class="Btn-body icon icon_right flex fxItemsCenter noMarg">
              <span class="_viewL_none fontS max-content">FOR CUSTOMERS</span>
  
              <span class="IconSide">
                <i class="Icon" data-icon="#common-arrowDown">
                  <svg class="Icon-cnt" width="25" height="25">
                    <use xlink:href="#common-arrowDown"></use>
                  </svg>
                </i>
              </span>
            </p>
          </a>
                      <div class="PI-case PI-case_other PI-case_new">
              <div class="PI-case-content=">
                <ul class="noList -paddYS noMargB fx fxCol -part_fill">
  <li class="PI-case_li borderB"><a href="https://products.drweb.com/register/v4/?lng=en">Activate your Dr.Web license</a></li>
  <li class="PI-case_li borderB"><a href="https://support.drweb.com/?lng=en">Technical support</a></li>
  <li class="PI-case_li borderB"><a href="https://download.drweb.com/doc/?lng=en">Documentation</a></li>
  <li class="PI-case_li borderB"><a href="https://download.drweb.com/?lng=en">Download Dr.Web</a></li>
</ul>                <a href="#Close" class="PI-case-close" data-swr="protecting" data-swr-click="hide">
                  <i data-icon="#common-cross.gray_1:hidden">Close</i>
                </a>
              </div>
            </div>
                  </div>
      </div>
    </div>

    <p class="PI-itm PI-itm_menu">
      <a class="PI-itm_menu-trig js-menu-open" href="#"
      ><b><i></i><i></i><i></i></b></a>
    </p>

        <div class="PI-itm PI-itm_quick">
      <a class="PI-itm_quick-trig" data-swr-group="quick_menu" data-swr-click="toggle" data-swr="menu" href="#"><b><i></i><i></i><i></i></b></a>
      <div class="PI-itm_quick-target" data-swr-click-outside="hide" data-swr-group="quick_menu" data-swr-target="menu">
        <ul class="PI-itm_quick-body">
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://partners.drweb.com/?lng=en">
    Buy from our partners
  </a></li>
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://estore.drweb.com/home/?lng=en">
    Buy online
  </a></li>
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://support.drweb.com/?lng=en">
    Ask about a purchase
  </a></li>
</ul>      </div>
    </div>
    
  </div><div class="PI-wrp PI-wrp_panel">

    <div class="PI-group PI-group_panel">

      <!-- Город -->

<!--<div class="PI-group-itm">
  <div class="PI-separator _viewL_none"></div>
</div>-->

<!-- Библиотека -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_bookmark" data-swr-target="bookmark">
    <a class="PI-icon" data-swr="bookmark" href="#Library">
      <i class="Icon" data-icon="#common-bookmark">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-bookmark">Library</use>
        </svg>
      </i>
      <span class="PI-icon-count"></span>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_bookmark">
      <div class="PI-case-content noPaddB uppercase">
        <span>My library</span>
      </div>
      <div class="PI-case-content -Grid_1of2 -viewS-Grid_1of1">
        <script type="text/javascript">
          var Drwebcom = {
            bookmarkit : function( site, title, description ) {
              var uri = 'https://www.drweb.com/social/bookmark/?';
              uri += 'site='   + encodeURIComponent( site );
              uri += '&title=' + encodeURIComponent( title );
              uri += '&descr=' + encodeURIComponent( description );
              
              Drwebcom.popup( uri );
              return false;
            },
            
            popup: function( url ) {
              this._win = window.open( url, '', 'toolbar=0,status=0,width=626,height=436' );
            }
          };
        </script>
        <p class="margYS">
          <i data-icon="#common-plus.Icon_portrait2.main_green_4.alignMiddle:hidden">+</i>
          <a class="main_green_4" href="#" onclick="return Drwebcom.bookmarkit( location.toString(), document.title, '')">Add to library</a>
        </p>
      </div>
    </div>
  </div>
</div>

<!-- Заказы -->
<!-- Шаринг -->

<!-- Поиск -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_search" data-swr-target="search">
    <a class="PI-icon" data-swr="search" href="#Search">
      <i class="Icon" data-icon="#common-search">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-search">Search</use>
        </svg>
      </i>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_search">
      <div class="PI-case-content uppercase">
        <span>Search</span>
        <form method="get" action="https://www.drweb.com/search/">
          <input type="hidden" name="lng" value="en">
          <p class="InputGroup noRadius noWrap margYS">
            <input class="Input" type="text" name="q" size="32" value="register a serial number" onfocus="if (this.value == 'register a serial number') this.value = ''" onblur="if (this.value == '') this.value = 'register a serial number'">
            <button class="Btn Btn_input bg_main_green_2 alignMiddle" type="submit" title="Search">
              <span class="Btn-body">
                <span class="Btn-text noPadd"><i class="Btn-text" data-icon="#common-search">Search</i></span>
              </span>
            </button>
          </p>
        </form>
      </div>
    </div>
  </div>
</div>

<!-- Поддержка -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_contact" data-swr-target="contact">
    <a class="PI-icon" data-swr="contact" href="#Contact">
      <i class="Icon" data-icon="#common-contact">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-contact">Contact us</use>
        </svg>
      </i>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_contact">
      <div class="PI-case-content">
        <span class="uppercase">24/7 Tech support</span>
        <span class="defaultNone _viewS_inlineBlock">|</span>
        <a class="floatR _viewS_noFloat" href="https://support.drweb.com/rules/">Rules regarding submitting</a>
      </div>
      <div class="userAuthNone">
        <div class="PI-case-content bg_stone_5 -Panel_alignMiddle">
          <div class="Panel Panel_iconSide icon icon_sizeM">
            <div class="Panel-forIcon">
              <i data-icon="#common-info.green_4"></i>
            </div><div class="Panel-content _viewS_margTS">
              <p class="noMarg uppercase"><b>Send a message</b></p>
              <div class="margYS paddRM">
                <a class="Btn margTC noRadius bg_green_4" href="https://support.drweb.com/support_wizard/?lng=en" target="_blank">
                  <span class="Btn-body icon icon_right" data-icon="#common-arrowRight">
                    <span class="Btn-text fontS uppercase">A query form</span>
                  </span>
                </a>
              </div>
            </div>
          </div>
        </div>
        <div class="PI-case-content">
          <p class="noMarg uppercase"><b>Call us</b></p>
          <p class="noMargT _viewS_margTS">
            <a href="tel:+74957894586" class="fontL alignMiddle noU black">+7 (495) 789-45-86</a>
          </p>
          <a class="b uppercase" href="https://forum.drweb.com/" target="_blank">Forum</a>
          <!--<span class="inlineBlock margXM">|</span>
          <a class="b uppercase" href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener">Self-support bot</a>
          <span class="IconZoom icon_sizeD alignMiddle">
            <i data-icon="#socnet-tg">Telegram</i>
          </span>-->
        </div>
      </div>
      <div class="defaultNone userAuthBlock">
        <div class="PI-case-content bg_stone_5">
          <p class="noMarg uppercase"><b>Your tickets</b></p>
          <div class="-Grid_1of2 -viewS-Grid_1of1">
            <div class="Grid margYS">
              <ul class="noList noMarg">
                <li>Total: <a href="https://www.drweb.com/user/support/requests/?mode=all&lng=en" id="support_req_all" target="_blank">
                  -
                </a></li>
                <li>Active: <a href="https://www.drweb.com/user/support/requests/?mode=not_closed&lng=en" id="support_req_not_closed" target="_blank">
                  -
                </a></li>
                <li id="lastTicketRow" class="defaultNone">Latest: <a href="https://www.drweb.com/user/support/requests/?mode=all&lng=en" id="support_req_last_not_closed" target="_blank">
                  -
                </a></li>
              </ul>
              <script>
                QData.Ready( 'user', function( data ){
                  if( ! data || ! data.authorized ) return;
        
                  QData.Ready( 'pi_requests',
                    function( data, api ) // when ready
                    {
                      $( '#support_req_all' )
                        .text( api.CountRequests() );
                      $( '#support_req_not_closed' )
                        .text( api.CountRequests( [5,52,53], true ) );

                      if( data.ticket.updated ) {
                        $( '#support_req_last_not_closed' )
                            .text( data.ticket.updated )
                        $( '#lastTicketRow' ).removeClass( 'defaultNone' );
                        var status_color = '';
                        switch( data.ticket.status ){
                            case 'waiting': status_color = 'red_2'; break
                            case 'closed': status_color = 'black'; break
                            case 'not_closed': break
                            case 'new': break
                        }
                        $( '#support_req_last_not_closed' ).addClass( status_color );
                      }
                    },
                    function( data, api ) // when loading
                    {
                      $( '#support_req_all, #support_req_not_closed, #support_req_last_not_closed' )
                        .html( '<img src="https://st.drweb.com/static/loading_28x4_green.gif" class="alignMiddle" alt="">' );
                    }
                  );
                });
              </script>
            </div><div class="Grid margYS">
              <a class="Btn Btn_slim noRadius bg_green_4" href="https://support.drweb.com/support_wizard/?lng=en">
                <span class="Btn-body">
                  <span class="Btn-text fontS uppercase">New ticket</span>
                </span>
              </a>
            </div>
          </div>
        </div>
        <div class="PI-case-content">
        <p class="noMarg uppercase"><b>Call us</b></p>
          <p class="noMarg _viewS_margTS">
            <a href="tel:+74957894586" class="fontL alignMiddle noU black">+7 (495) 789-45-86</a>
            <!--<span class="paddXS alignMiddle">|</span>
            <a class="alignMiddle inlineBlock noU" href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener">
              <span class="alignMiddle uppercase">Self-support bot</span>
              <span class="IconZoom icon_sizeD">
                <i data-icon="#socnet-tg">Telegram</i>
              </span>
            </a>-->
          </p>
        </div>
      </div>
    </div>
  </div>
</div>

<!-- Профиль -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_profile" data-swr-target="profile">
    <a class="PI-icon" data-swr="profile" href="#Profile" onclick="drw_login_widget_once()">
      <i class="Icon" data-icon="#common-profile">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-profile">Profile</use>
        </svg>
      </i>
      <span class="PI-icon-stat">
        <i data-icon="#common-tick:hidden"></i>
      </span>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_profile">
      <script>
        window[ 'drw_login_widget_reqdata' ] = { 'style': 'pi_v2', 'caseid': 'case_profile', 'focus': 'drw_site' };
        window[ 'drw_login_widget_set_place' ] = function( place ) {
          if ( typeof loginWidgetFocusInput == 'function' && $( 'html' ).hasClass( 'userNotAuthorized' ) )
            return loginWidgetFocusInput();
          if ( typeof loginWidgetFocusForm == 'function' )
            loginWidgetFocusForm( place );
        }
        window[ 'drw_login_widget_once' ] = function( opt ) {
          if ( opt && opt.focus ) window[ 'drw_login_widget_reqdata' ].focus = opt.focus;
          $.getScript( 'https://st.drweb.com/static/js/auth/widgets/login_pi.js?rev=1' );
        }
      </script>
      <div class="PI-case-content" id="case_profile">
        <div class="alignCenter paddYM">
          <i data-icon="#common-spinner.Icon_spinSteps12.icon_sizeL.main_green_4"></i>
        </div>
      </div>
    </div>
  </div>
</div>
            <div class="PI-group-itm">
        <div class="PI-separator _viewL_none"></div>
      </div>

      <!-- Язык -->
      <div class="PI-group-itm">
        <div class="PI-itm PI-itm_lng" data-swr-target="lng">
                  <a class="Btn Btn_clean Btn_slim paddXC main_green_4" data-swr="lng" href="#Language">
            <p class="Btn-body">
              <span class="Btn-text noPadd fontS">
                <span class="PI-itm_lngCurr uppercase">
                                  EN                                </span>
              </span>
            </p>
          </a>
                  <div class="PI-case PI-case_lng">
            <div class="PI-case-content">
                                              <a  href="javascript:drweb_site_change_lng('ru')"  class="PI-case_lng-itm lng_ru">
                  RU                </a>
                                                              <a  href="javascript:drweb_site_change_lng('cn')"  class="PI-case_lng-itm lng_cn">
                  CN                </a>
                                                              <a  href="javascript:drweb_site_change_lng('de')"  class="PI-case_lng-itm lng_de">
                  DE                </a>
                                                              <a  class="PI-case_lng-itm lng_en">
                  EN                </a>
                                                              <a  href="javascript:drweb_site_change_lng('es')"  class="PI-case_lng-itm lng_es">
                  ES                </a>
                                                              <a  href="javascript:drweb_site_change_lng('fr')"  class="PI-case_lng-itm lng_fr">
                  FR                </a>
                                                              <a  href="javascript:drweb_site_change_lng('it')"  class="PI-case_lng-itm lng_it">
                  IT                </a>
                                                              <a  href="javascript:drweb_site_change_lng('ja')"  class="PI-case_lng-itm lng_ja">
                  JP                </a>
                                                              <a  href="javascript:drweb_site_change_lng('pl')"  class="PI-case_lng-itm lng_pl">
                  PL                </a>
                                                              <a  href="javascript:drweb_site_change_lng('kk')"  class="PI-case_lng-itm lng_kk">
                  KZ                </a>
                                                              <a  href="javascript:drweb_site_change_lng('uk')"  class="PI-case_lng-itm lng_uk">
                  UA                </a>
                                                              <a  href="javascript:drweb_site_change_lng('be')"  class="PI-case_lng-itm lng_be">
                  BY                </a>
                                          </div>
            <a href="#Close" class="PI-case-close" data-swr="lng" data-swr-click="hide">
              <i data-icon="#common-cross.white:hidden">Close</i>
            </a>
          </div>
                  </div>
      </div>
      
    </div>

  </div>

</div>

<style>
  .PI-case_new {
    border: none;
  }
  .PI-case_other {
    width: auto;
  }
  .PI-case_li a {
    padding-left: 6px;
    text-decoration: none;
    color: #000;
  }
  .PI-case_li:hover {
    background-color: #d4d9dc;
  }
  .PI-case_new .PI-case-close {
    background-color: transparent;
  }
  .logo-marker {
    display: flex;
    gap: 17px;
    margin-right: 40px;
    color: #000;
  }
  .logo-marker__separator {
    border-left: 1px solid #000;
  }
  .green-head {
    min-height: 58px;
  }
  .max-content {
    width: max-content;
  }
  @media screen and (max-width: 966px){
    .PI-case {
      padding-top: 0;
    }
    .PI-case_other {
      width: 100%;
    }
    .logo-marker {
      color: #fff;
      margin-right: 17px;
    }
    .logo-drweb {
      color: #fff;
      width: 100%;
      max-width: 200px;
    }
    .logo-marker__separator {
      border-color: #fff;
  }
  }
  @media screen and (max-width: 480px){
    .logo-marker {
      display: none;
    }
  }
</style>

<!-- theme/tile_mobi/head_pi.tt end -->


<!-- theme/tile_mobi/head_nav.tt start -->


<div class="NAV container container_cell bg_main_green_4 ">

    <div class="NAV-other on_hover">
    <a class="NAV-other-trig" href="javascript:void(0)" title="Other sections"><b><i></i><i></i><i></i></b></a>
    <div class="NAV-other-target use_hover">
      <ul class="NAV-other-body">
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://products.drweb.com/home/?lng=en">
      Home
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://products.drweb.com/business/?lng=en">
      Business
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://estore.drweb.com/home/?lng=en">
      eStore
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://promotions.drweb.com/?lng=en">
      Discounts
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://download.drweb.com/?lng=en">
      Download
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://support.drweb.com/support_wizard/?lng=en">
      Support
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://training.drweb.com/?lng=en">
      Training
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://partners.drweb.com/find_partner/?lng=en">
      Partners
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://news.drweb.com/?lng=en">
      Information
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://antifraud.drweb.com/?lng=en">
      Anti-cyberfraud center
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://license.drweb.com/?lng=en">
      Licensing center
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://customers.drweb.com/?lng=en">
      Customers
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://vms.drweb.com/?lng=en">
      Anti-virus lab
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://company.drweb.com/?lng=en">
      About Doctor Web
    </a>
  </li>
</ul>    </div>
  </div>
  
  <div class="NAV-store ">

    <div class="NAV-wrp bg_green_4">
  <dl class="NAV-case on_hover">

    <dt class="NAV-section">
      <a href="javascript:void(0)" class="NAV-section-link">
        <span class="NAV-section-name">News</span>
      </a>
      <div class="NAV-case-arrow">
        <i data-icon="#common-arrowDown:hidden"></i>
      </div>
    </dt>

    <dd class="NAV-content use_hover width_2of8">
      <div class="margTM margXM">

        <ul class="noMargB-" itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn orange_2"
                href="https://news.drweb.com/news/subscribe/?lng=en"

                data-dyn-mobi-menu="News // Subscribe to news digests"
                itemprop="url">
                Subscribe to news digests

              </a>
            </li>
            <li class="NAV-itm defaultNone userAuthInlineBlock" itemprop="name">
              <a
                class="NAV-link js-data-dyn lilac_1"
                href="https://www.drweb.com/user/mailing+subscruptions/?mode=archive&channel=135257&lng=en"

                data-dyn-mobi-menu="News // News digests"
                data-dyn-menu-node-cls="defaultNone userAuthBlock"
                itemprop="url">
                News digests

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/?lng=en"

                data-dyn-mobi-menu="News // All news"
                itemprop="url">
                All news

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/comments/?lng=en"

                data-dyn-mobi-menu="News // Comments"
                itemprop="url">
                Comments

              </a>
            </li>
        </ul>

        <p class="NAV-title paddTM-">News by topic</p>
          <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=6&lng=en"

                data-dyn-mobi-menu="News // News by topic // Dr.Web products"
                itemprop="url">
                Dr.Web products

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=8&lng=en"

                data-dyn-mobi-menu="News // News by topic // Updates"
                itemprop="url">
                Updates

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=7&lng=en"

                data-dyn-mobi-menu="News // News by topic // Dr.Web AV-Desk"
                itemprop="url">
                Dr.Web AV-Desk

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=11&lng=en"

                data-dyn-mobi-menu="News // News by topic // Promos"
                itemprop="url">
                Promos

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=28&lng=en"

                data-dyn-mobi-menu="News // News by topic // Training news"
                itemprop="url">
                Training news

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=48&lng=en"

                data-dyn-mobi-menu="News // News by topic // Community news"
                itemprop="url">
                Community news

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=12&lng=en"

                data-dyn-mobi-menu="News // News by topic // Corporate news"
                itemprop="url">
                Corporate news

              </a>
            </li>
          </ul>

      </div>
    </dd>

  </dl>
</div>

<div class="NAV-wrp">
  <dl class="NAV-case on_hover">

    <dt class="NAV-section">
      <a href="javascript:void(0)" class="NAV-section-link">
        <span class="NAV-section-name">Virus alerts</span>
      </a>
      <div class="NAV-case-arrow">
        <i data-icon="#common-arrowDown:hidden"></i>
      </div>
    </dt>

    <dd class="NAV-content use_hover width_2of8">
      <div class="margTM margXM">

          <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=10&lng=en"

                data-dyn-mobi-menu="Virus alerts // Monthly reviews"
                itemprop="url">
                Monthly reviews

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=23&lng=en"

                data-dyn-mobi-menu="Virus alerts // Real-time threat news"
                itemprop="url">
                Real-time threat news

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=55&lng=en"

                data-dyn-mobi-menu='Virus alerts // "Bait"'
                itemprop="url">
                "Bait"

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=9&lng=en"

                data-dyn-mobi-menu="Virus alerts // About viruses"
                itemprop="url">
                About viruses

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/list/?c=38&lng=en"

                data-dyn-mobi-menu="Virus alerts // About mobile threats"
                itemprop="url">
                About mobile threats

              </a>
            </li>
          </ul>

      </div>
    </dd>

  </dl>
</div>

<div class="NAV-wrp">
  <dl class="NAV-case on_hover">

    <dt class="NAV-section">
      <a href="javascript:void(0)" class="NAV-section-link">
        <span class="NAV-section-name noWrap">The Anti-virus Times</span>
      </a>
      <div class="NAV-case-arrow">
        <i data-icon="#common-arrowDown:hidden"></i>
      </div>
    </dt>

    <dd class="NAV-content use_hover width_2of8">
      <div class="margTM margXM">

          <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://www.drweb.com/pravda/?lng=en"

                data-dyn-mobi-menu="The Anti-virus Times // Issue of the day"
                itemprop="url">
                Issue of the day

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://www.drweb.com/pravda/issues/?lng=en"

                data-dyn-mobi-menu="The Anti-virus Times // All issues"
                itemprop="url">
                All issues

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://www.drweb.com/pravda/rubrics/?lng=en"

                data-dyn-mobi-menu="The Anti-virus Times // Categories"
                itemprop="url">
                Categories

              </a>
            </li>
          </ul>

      </div>
    </dd>

  </dl>
</div>

<div class="NAV-wrp">
  <dl class="NAV-case on_hover">

    <dt class="NAV-section">
      <a href="javascript:void(0)" class="NAV-section-link">
        <span class="NAV-section-name">News boxes</span>
      </a>
      <div class="NAV-case-arrow">
        <i data-icon="#common-arrowDown:hidden"></i>
      </div>
    </dt>

    <dd class="NAV-content use_hover width_2of8">
      <div class="margTM margXM">

          <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://free.drweb.com/for+web+sites/?lng=en"

                data-dyn-mobi-menu="News boxes // News boxes for your site"
                itemprop="url">
                News boxes for your site

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://news.drweb.com/rss/?lng=en"

                data-dyn-mobi-menu="News boxes // RSS feeds"
                itemprop="url">
                RSS feeds

              </a>
            </li>
          </ul>

      </div>
    </dd>

  </dl>
</div>

<div class="NAV-wrp">
  <dl class="NAV-case on_hover">

    <dt class="NAV-section">
      <a href="javascript:void(0)" class="NAV-section-link">
        <span class="NAV-section-name">Press center</span>
      </a>
      <div class="NAV-case-arrow">
        <i data-icon="#common-arrowDown:hidden"></i>
      </div>
    </dt>

    <dd class="NAV-content use_hover width_2of8 right">
      <div class="margTM margXM">

          <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://company.drweb.com/press/?lng=en"

                data-dyn-mobi-menu="Press center // Press contact info"
                itemprop="url">
                Press contact info

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://company.drweb.com/press/?lng=en"

                data-dyn-mobi-menu="Press center // Press kit"
                itemprop="url">
                Press kit

              </a>
            </li>
            <li class="NAV-itm" itemprop="name">
              <a
                class="NAV-link js-data-dyn"
                href="https://company.drweb.com/press/gallery/?lng=en"

                data-dyn-mobi-menu="Press center // Gallery"
                itemprop="url">
                Gallery

              </a>
            </li>
          </ul>

      </div>
    </dd>

  </dl>
</div>
  </div>

</div>

<div id="ShowIt"></div>

<!-- theme/tile_mobi/head_nav.tt end -->

<!-- theme/tile_mobi/head_body.tt start -->




<!-- theme/tile_mobi/head_body.tt end -->

</div>
	


<!-- theme/tile_mobi/content.tt start -->


<div class="CONTENT">

		
    <script type="text/javascript">
      $( document ).on( 'click', '.jsArrowPull', function( e ){
        e = e || event;
        e.preventDefault();
      });

      function mention( username ) {
        var text = $( '#message' ).val();
        text += username + ', ';

        $( '#message' ).val( text );
      }
    </script>

    <div class="CellBlock noBg noMarg noPadd">
      <div class="container container_cell bg_white paddYM paddXM margTS">

      <div class="content" id="ttnews">

        <input id="page_lng" value="en" type="hidden" />
        <!-- tmplt: news -->
        <!-- inb4 NEWS_DATA_TT_NEW -->
        <!-- NEWS_DATA_TT_NEW start -->

  
    <link href="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/css/components/tooltip.css?r=1" rel="stylesheet" type="text/css" />
    <script src="//st.drweb.com/static/js/clipboard.js"></script>

    <p class="noMarg fx fxItemsCenter fxBetween">

      <a class="footnote" href="https://news.drweb.com/list/?p=0&lng=en&c=23">Back to the news list</a>

      <span tooltip="Copy the link to this page" flow="left" class="inlineBlock">
        <button
          class="Btn Btn_clean main_green_4 jsClipboard"
          data-clipboard-text="https://news.drweb.com/show/?i=14646&c=23&lng=en"
          data-clipboard-hint-class="-Icon_statTrue_show"
        >
          <span class="Btn-body icon icon_right">
            <span class="IconSide">
              <i data-icon="#common-copyLink.Icon_statDefault"></i>
              <span class="IconAlienate icon_sizeS">
                <i data-icon="#common-tick.Icon_statTrue"></i>
              </span>
            </span>
          </span>
        </button>
      </span>

    </p>

    <div class="paddYM paddRM unMargXM" id="NewsTitle">

      <div class="Panel Panel_iconSide icon icon_sizeS">
        <span class="Panel-forIcon">
          <a href="https://news.drweb.com/list/?c=14" id="catUrl">
            <img src="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/img/decor/news_rubriki_14.png" id="catImg">
          </a>
        </span><!--
        --><span class="Panel-content black">
          <h2  class="noMargY fontXL _viewS_fontL b">Linux backdoor malware infects WordPress-based websites</h2>
        </span>
      </div>

    </div>

    <script>
      //script ico-images for header news (& link to category)
      (function(){
        var URL = window.location.toString();
        var categoriesArr = [6,7,8,9,10,11,12,14,23,28,38,48];//categories with custom imagies
        var category;
        var imageURL = '//st.drweb.com/static/new-www/themes/tiles_mobi/assets/img/decor/news_rubriki_14.png';//default
        var categoryURL = '//news.drweb.com/list/?c=14';//default

        category = URL.match( /[\?&]c=\d{1,2}/ig );

        if(category !== null) {

          category = category.toString().match( /\d{1,2}/i ).toString();

          for (var i = 0, len = categoriesArr.length; i < len; i++) {
            if( categoriesArr[i] == category )
            {
              imageURL = '//st.drweb.com/static/new-www/themes/tiles_mobi/assets/img/decor/news_rubriki_' + category + '.png';
              categoryURL = 'https://news.drweb.com/list/?c=' + category;

              i = len;
            }
          }

          document.getElementById('catImg').setAttribute('src', imageURL);
          document.getElementById('catUrl').setAttribute('href', categoryURL);

        }

        else{

          document.getElementById('catImg').setAttribute('src', '//st.drweb.com/static/new-www/themes/tiles_mobi/assets/img/decor/news_rubriki_14.png');
          document.getElementById('catUrl').setAttribute('href', '//news.drweb.com/list/?c=14');
        }

      })();
    </script>

    <div>
      <p><b>December 30, 2022</b></p>

<p><strong><newslead>Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites.</newslead></strong></p>

<p>For many years cybercriminals have been attacking WordPress-driven websites. Information security experts register cases when various vulnerabilities of the WordPress platform are used in order to hack sites and inject malicious scripts into them. An analysis of an uncovered trojan application, performed by Doctor Webs’ specialists, revealed that it could be the malicious tool that cybercriminals have been using for more than three years to carry out such attacks and monetize the resale of traffic, or arbitrage.</p>

<p>Dubbed <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.1&lng=en"><b>Linux.BackDoor.WordPressExploit.1</b></a> in accordance with Dr.Web anti-virus classification, this malware targets 32-bit versions of Linux, but it can also run on 64-bit versions. <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.1&lng=en"><b>Linux.BackDoor.WordPressExploit.1</b></a> is a backdoor that is remotely controlled by malicious actors. Upon their command, it is able to perform the following actions:</p>

<ul>
  <li>Attack a specified webpage (website);</li>
  <li>Switch to standby mode;</li>
  <li>Shut itself down;</li>
  <li>Pause logging its actions.</li>
</ul>

<p>The main functionality of the trojan is to hack websites based on a WordPress CMS (Content Management System) and inject a malicious script into their webpages. To do so, it uses known vulnerabilities in WordPress plugins and website themes. Before attacking, the trojan contacts its C&C server and receives the address of the site it is to infect. Next, <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.1&lng=en"><b>Linux.BackDoor.WordPressExploit.1</b></a> successively tries exploiting vulnerabilities in the following outdated plugins and themes that can be installed on a website:</p>

<ul>
  <li>WP Live Chat Support Plugin</li>
  <li>WordPress – Yuzo Related Posts</li>
  <li>Yellow Pencil Visual Theme Customizer Plugin</li>
  <li>Easysmtp</li>
  <li>WP GDPR Compliance Plugin</li>
  <li>Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)</li>
  <li>Thim Core</li>
  <li>Google Code Inserter</li>
  <li>Total Donations Plugin</li>
  <li>Post Custom Templates Lite</li>
  <li>WP Quick Booking Manager</li>
  <li>Faceboor Live Chat by Zotabox</li>
  <li>Blog Designer WordPress Plugin</li>
  <li>WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)</li>
  <li>WP-Matomo Integration (WP-Piwik)</li>
  <li>WordPress ND Shortcodes For Visual Composer</li>
  <li>WP Live Chat</li>
  <li>Coming Soon Page and Maintenance Mode</li>
  <li>Hybrid</li>
</ul>

<p>If one or more vulnerabilities are successfully exploited, the targeted page is injected with a malicious JavaScript that is downloaded from a remote server. With that, the injection is done in such a way that when the infected page is loaded, this JavaScript will be initiated first—regardless of the original contents of the page. At this point, whenever users click anywhere on the infected page, they will be transferred to the website the attackers need users to go to.</p>

<p>An example of one of the infected pages is shown in the screenshot below:</p>

<p class="alignCenter">
   <a href="https://st.drweb.com/static/new-www/news/2022/december/inject.png" class="preview"><img src="https://st.drweb.com/static/new-www/news/2022/december/inject.1.png" alt="An example of one of the infected pages"></a>
</p>

<p>The trojan application collects statistics on its work. It tracks the overall number of websites attacked, every case of a vulnerability being exploited successfully, and additionally—the number of times it has successfully exploited the WordPress Ultimate FAQ plugin and the Facebook messenger from Zotabox. In addition, it informs the remote server about all detected unpatched vulnerabilities.</p>

<p>Along with the current modification of this trojan application, our specialists also discovered its updated version <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.2&lng=en"><b>Linux.BackDoor.WordPressExploit.2</b></a>. It differs from the original one by the C&C server address, the address of the domain from which the malicious JavaScript is downloaded, and also by an additional list of exploited vulnerabilities for the following plugins:</p>

<ul>
  <li>Brizy WordPress Plugin</li>
  <li>FV Flowplayer Video Player</li>
  <li>WooCommerce</li>
  <li>WordPress Coming Soon Page</li>
  <li>WordPress theme OneTone</li>
  <li>Simple Fields WordPress Plugin</li>
  <li>WordPress Delucks SEO plugin</li>
  <li>Poll, Survey, Form & Quiz Maker by OpinionStage</li>
  <li>Social Metrics Tracker</li>
  <li>WPeMatico RSS Feed Fetcher</li>
  <li>Rich Reviews plugin</li>
</ul>

<p>With that, both trojan variants have been found to contain unimplemented functionality for hacking the administrator accounts of targeted websites through a brute-force attack—by applying known logins and passwords, using special vocabularies. It is possible that this functionality was present in earlier modifications, or, conversely, that attackers plan to use it for future versions of this malware. If such an option is implemented in newer versions of the backdoor, cybercriminals will even be able to successfully attack some of those websites that use current plugin versions with patched vulnerabilities.</p>

<p>Doctor Web recommends that owners of WordPress-based websites keep all the components of the platform up-to-date, including third-party add-ons and themes, and also use strong and unique logins and passwords for their accounts.</p>

<p><a href="https://github.com/DoctorWebLtd/malware-iocs/tree/master/Linux.Backdoor.WordPressExploit.1" target="_blank" rel="noopener noreferrer">Indicators of compromise</a></p>

<p>More details on <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.1&lng=en"><b>Linux.BackDoor.WordPressExploit.1</b></a></p>
<p>More details on <a href="https://vms.drweb.com/search/?q=Linux.BackDoor.WordPressExploit.2&lng=en"><b>Linux.BackDoor.WordPressExploit.2</b></a></p>
    </div>

    <div id="NewsArrowPlace"></div>

    <!--Bannertime-->
    
        <!--Bannertime //-->

    <div class="share_buttons">
      <!-- BOX_NEWS_DRWEBLINGS_FOR_ACTIVITY -->
<div class="CellBlock noBg margTL margBS noPadd negativePaddX">
  <div class="container paddYM paddXM _viewM_paddXS" style="background-color: #eddecd">

<div class="news_rating paddBM paddXL _viewS_noPaddX -Grid_1of4 -viewL-Grid_1of3 -viewM-Grid_1of3 _viewM_alignCenter">

      <div class="Grid paddRS _viewM_Grid_span3">     
        <p class="margBS b _viewM_noMargB">Rate</p>


        <div class="inlineBlock rating_no_auth _viewM_margBM">
            <button class="likes"><span class="b" id="likes">+ </span> </button>
            <button class="dislikes"><span class="b" id="dislikes">- </span> </button>
            <div class="rating_no_auth_block Alert Alert_info">              
              To vote, log in under your account or <a href="https://f2.drweb.com/lr/?to=https%3A%2F%2Fwww.drweb.com%2Fuser%2Fregistration%2F%3Ffrom%3Dnews">create</a> an account if you don't have one yet.
            </div>
        </div>
  
</div><!----><div class="Grid">
    
        <p class="margBS b">
          Repost 
        </p>
        <div class="noUnderline">
          <a class="paddRS" href="http://vk.com/drwebuser">
              <img src="//st.drweb.com/static/new-www/social/no_radius/vkontakte.png" alt="[VK]">
          </a>
          <a href="https://twitter.com/Doctor_Web">
              <img src="//st.drweb.com/static/new-www/social/no_radius/twitter.png" alt="[Twitter]">
          </a>
        </div>
      </div><!--

   --><div class="Grid">
        <p class="margBS b">
          Like
        </p>
        <a href="https://www.facebook.com/drwebcom/">
            <img src="//st.drweb.com/static/new-www/social/no_radius/facebook.png" alt="[facebook]">
        </a>
      </div><!--
   --><div class="Grid _viewL_none"></div>

</div>

  <div class="userAuthNone- _viewM_paddXS">
    <!--<p class="gray_2">
      To get your award points, go to the news page when <a data-swr="profile" data-swr-group="header" data-swr-click="tab" href="javascript:void(0)" onclick="$( 'html, body' ).animate({ scrollTop: 0 }, 200 ); drw_login_widget_once()">logged</a> in under your Doctor Web account (or <a href="https://f2.drweb.com/lr/?to=https%3A%2F%2Fwww.drweb.com%2Fuser%2Fregistration%2F%3Flng%3Den%26from%3Dnews">create an account</a>). Your account must be <a href="https://www.drweb.com/user/social/?lng=en">linked</a> with one of your social network accounts in order for you to receive award points for participating in our website activities. 
    </p>-->

    <p class="_viewS_paddLM">
      <a class="_viewS_block paddYS" href="https://www.drweb.com/user/advantages/?lng=en">What is the benefit of having an account?</a>
      <!--<span class="paddXS _viewS_none">|</span>
      <a class="_viewS_block" href="https://www.drweb.com/user/how_win/?lng=en">How can I earn Dr.Webling award points? </a>-->
    </p>
  </div>

  </div>
</div>


<!-- BOX_NEWS_DRWEBLINGS_FOR_ACTIVITY END -->
    </div>

  
<!-- NEWS_DATA_TT_NEW end -->
        <!-- after NEWS_DATA_TT_NEW -->

        <link href="//st.drweb.com/static/new-www/themes/tiles/css/news_comments_new.css" media="screen" rel="stylesheet" type="text/css"/>

                  <div class="news_comments">
            <!-- send comments start -->
            <div class="news_comments_send">
              <h2 class="fontXL">Tell us what you think</h2>

<p>To ask Doctor Web’s site administration about a news item, enter @admin at the beginning of your comment. If your question is for the author of one of the comments, put @ before their names.</p>

                          </div>
            <!-- send comments end -->

            <script type="text/javascript">
              function makeSharePanel( container, id, text ) {
                  var title   = document.title;
                  var url     = Additions.Helper.make_url( Additions.Helper.get_location(), {
                      'comment': ( parseInt( id, 10 ) || 0 ),
                      'i': '14646',
                      'c': '23',
                      'lng': 'en',
                      'p': '0'
                  } );

                  return __makeSharePanel( container, url, title, text );
              }

              function load_news_comments() {
                window[ 'load_news_comments' ] = function(){ return true; };

                return iq_cs_load_comments( '//' + window.location.host + '/news/view/comments/', {
                  'node': parseInt( '121035', 10 ),
                  'page': '',
                  'i': '14646',
                  'c': '23',
                  'lng': 'en',
                  'p': '0',
                  'm': ''
                } );
              }

              var SERVICE_LIKE = '//' + window.location.host + '/news/karma_aj';
              var CROSSLINK    = 14646;
              var NEWS_CLIENT  = 23;
              var LNG          = 'en';

              function onKarma( obj ) {
                if( obj.state == 'ok' ) {
                  var likes    = '+ ' + obj.data.likes;
                  var dislikes = '- ' + obj.data.dislikes;

                  $( '#likes' ).text( likes );
                  $( '#dislikes' ).text(  dislikes );

                } else {
                  //alert( 'Error' );
                }

                return true;
              }

              function AJAXLoad( url, params, handler ) {
                $.get( url, params, handler );
                return false;
              }

              function karma() {
                AJAXLoad( SERVICE_LIKE, { mode: 'default', i: CROSSLINK, c: NEWS_CLIENT, lng: LNG }, onKarma );
              }

              function like() {
                AJAXLoad( SERVICE_LIKE, { mode: 'like', i: CROSSLINK, c: NEWS_CLIENT, lng: LNG }, onKarma );
              }

              function dislike() {
                AJAXLoad( SERVICE_LIKE, { mode: 'dislike', i: CROSSLINK, c: NEWS_CLIENT, lng: LNG }, onKarma );
              }

              $( document ).ready(function() {
                karma();
              });

            </script>


            <br/>
            <h3>Other comments </h3>
<!-- iq_cs_comments_holder begin -->


<script type="text/javascript">
function __dummy(){}

function __makeSharePanel( container, url, title, text )
{
	var set_title_to_text_flags = {
		'twitter': true
	};

	var make_params = function( _method, _url, _title, _text )
	{
		return 'addthis:url="' + _url + '" addthis:title="' + ( set_title_to_text_flags[ _method ] ? _text : _title ) + '" addthis:description="' + _text + '"';
	};

	var buttons = [ 'vk', 'facebook', 'twitter', 'livejournal', 'mymailru', 'odnoklassniki_ru', 'google_plusone_share', 'compact' ];
	var block   = '';

	for( var i = 0; i < buttons.length; ++i )
		block += '<a class="addthis_button_' + buttons[ i ] + '" ' + make_params( buttons[ i ], url, title, text ) + '></a>';

	var $container = $(container);

	$container.html( '<div class="addthis_toolbox addthis_default_style">' + block + '</div>' );

	return false;
}

function flush_addthis()
{
  var addthis_keys = new Object([ 'addthis', '_adr', '_atc', '_atd', '_ate', '_atr', '_atw' ]);

  for( var i in addthis_keys )
  {
  	var key = addthis_keys[ i ];

	try
	{
		delete window[ key ];

	} catch( e )
	{
		window[ key ] = undefined;
	}
  }

  $('#at20mc, #at_email, #at16pib, #at16pc, #at16pi, #at_share, #at_complete, #at_success, #at_error').each(function(){ $(this).remove(); });

  return true;
}

function load_addthis()
{
//  window[ 'load_addthis' ] = function(){ return true };
  if( window[ 'addthis' ] ) flush_addthis();

  var old_cache = $.ajaxSettings.cache;

  $.ajaxSettings.cache = true;
  $.getScript( '//s7.addthis.com/js/250/addthis_widget.js#domready=1&pubid=ra-4ee89223124ebd75', function(){ addthis.init(); } );
  $.ajaxSettings.cache = old_cache;

  return true;
}

function iq_cs_load_next_page( url, params )
{
    flush_addthis();
  
  $.ajax({
    'url': url,
    'type': 'GET',
    'data': params,
    'dataType': 'html',
    'success': function( result )
    {
      var $result = $( '<div>' + result + '</div>' );
      var $select = $('#pager select:eq(0)');

            var crutch  = ( ( ( ( result || '' ).split( /\n/ ) || new Object([]) ).join(' ') || '' ).match( /(<scrip.+?>[\s+]?makeSharePanel.+?<\/script>)/g ) || new Object([]) );
      
      $('.feedback_nodes:eq(0)').replaceWith( $result.find('.feedback_nodes:eq(0)') );

      $select.html( $result.find('#pager select:eq(0)').html() );
      $select.trigger( 'liszt:updated' );

      Additions.Overlay.Image.hide();

            for( var i = 0; i < crutch.length; ++i )
      	eval( ( crutch[ i ].match( /(makeSharePanel\(.*\))/ ) || new Object([]) )[ 0 ] );

      load_addthis();
      
      return true;
    }
  });

  return true;
}

function iq_cs_load_comments( url, params )
{
    flush_addthis();
  
  $.ajax({
    'url': url,
    'type': 'GET',
    'data': params,
    'dataType': 'html',
    'success': function( result )
    {
      $( '#comments_holder' ).replaceWith( result );

            load_addthis();
      
      return true;
    }
  });

  return true;
}
</script>


 

<div id="comments_holder_wrapper">

<!-- <div id="comments_holder" style="margin:0px auto;background-color: #efefef; border: 4px solid #bbc0c4; padding: 9px 45px 9px 45px;width: 46px;"><img src="/upload/3e9e29e064d95ecef91b0c8864d9b1e3_1216650269_search.gif" alt="" title=""></div> -->
<div id="comments_holder" style="margin:0px auto;width: 46px;padding: 9px 45px 9px 45px;"><img src="/upload/3e9e29e064d95ecef91b0c8864d9b1e3_1216650269_search.gif" alt="" title=""></div>

 
<script type="text/javascript">setTimeout('load_news_comments()',1);</script>


</div>

 
<!-- iq_cs_comments_holder end -->


          </div>
        
        </div>

      </div>
    </div>

  
	
</div>

<!-- theme/tile_mobi/content.tt end -->


<!-- TAIL -->
<div class="TAIL">


	
	<div class="TAIL-case paddYS bg_khaki_1">

				<!-- theme/tile_mobi/footer_content_pi.tt (used TPL__GLOB__TAIL__RESOURCES) start -->


<div class="
  container
  fx
  -fx -fxCol
  -part_4 -@m:part_2 -@s:part_1
  -paddLS -paddRM -paddYS
  -margYS
">

  <div class="white fontXS -noMargB">
    <p class="flex fxItemsCenter">
      <span class="inlineBlock">&copy; Doctor&nbsp;Web<br>2003 &mdash; 2023</span>
    </p>
    <p>
      Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies      <br/><br/>
      <b></b>
    </p>
  </div>

  <div class="-noMargB">
    <ul class="List noList unMargTS fontS">
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/?lng=en">About Doctor Web</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/moscow/?lng=en">Contact info</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/moscow/?lng=en">How to reach us in Moscow</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/offices/?lng=en">Doctor Web offices in other countries</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/press/?lng=en">Press center</a></li>
</ul>  </div>

  <div class="-noMargB">
    <p class="margBS fontS uppercase white">Doctor Web in social networks</p>
    <p class="margYS cursorDefault">
      <a class="noU" href="https://www.facebook.com/drwebcom" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-fb">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-fb">[Facebook]</use>
  </svg></i></em>
</a>
<a class="noU" href="https://twitter.com/#!/DrWeb_antivirus" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-tw">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-tw">[Twitter]</use>
  </svg></i></em>
</a>
<a class="noU" href="https://instagram.com/drwebgram" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-im">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-im">[Instagram]</use>
  </svg></i></em>
</a>
<a class="noU" href="https://www.youtube.com/playlist?list=PLIe8-6Rv6WvrX4nK5Vm99QzNAKk2L5PsN" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-yt">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-yt">[YouTube]</use>
  </svg></i></em>
</a>    </p>
    <a class="fontXS uppercase main_green_4" href="https://www.drweb.com/user/social/?lng=en">Link accounts</a>
      </div>

  <div class="-noMargB">
        <p class="fontS uppercase white margBS">
      For Telegram      <span class="IconZoom icon_sizeD alignMiddle margLC unMargTC">
        <i data-icon="#socnet-tg"></i>
      </span>
    </p>
    <ul class="List noMarg noList fontXS">
<li><a href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener" class="main_green_4">Self-support</a></li>
</ul>            <p class="margTA paddTM">
      <a class="Btn Btn_block Btn_border Btn_transparent" href="https://company.drweb.com/policy/?lng=en">
        <span class="Btn-body">
          <span class="Btn-text fontXS resetLineHeight">
            Privacy Policy          </span><span class="IconSide">
            <span class="defaultNone _viewM_block">
              <i data-icon="#common-arrowRight"></i>
            </span>
          </span>
        </span>
      </a>
    </p>
      </div>

</div>
<!-- theme/tile_mobi/footer_content_pi.tt end -->

		
	</div>
</div>

<div class="noHeight overflowHidden">
<!-- Демо Dr.Web для Android (Huawei-Honor) -->
<div hidden style="display:none" id="msg_android_huawei" data-showIt-every="days:1">
  <div class="paddYC paddXM margRL alignLeft _viewS_noMargT fx fxItemsCenter -noMargB -margTS">

    <p class="margRL">
      <span class="block paddXS resetLineHeight margBS">
        <b class="fontM">Download</b><br>Dr.Web for Android
      </span>
      <a href="https://f2.drweb.com/lr/?to=https%3A%2F%2Fappgallery.huawei.com%2F%23%2Fapp%2FC101669955">
        <img class="margLC" src="https://st.drweb.com/static/new-www/img/drweb_for_android_demo_via_appgallery_en.png" alt="Available in AppGallery">
      </a>
    </p>

    <ul class="IconList IconList_spaceM noMargY">
      <li class="icon" data-icon="#common-tick.main_green_4">
        Free three-month trial <!--Free 14-day trial (когда акция закончится)-->
      </li>
      <li class="icon" data-icon="#common-tick.main_green_4">
        All protection features available
      </li>
      <li class="icon" data-icon="#common-tick.main_green_4">
        Renew your trial license in<br>AppGallery/on Google Pay 
      </li>
    </ul>

  </div>
</div>

<script>
  $(function(){

    var ua = window.navigator.userAgent;
    var isMacLike = /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform);
    var isAndroid = ua.toLowerCase().indexOf("android") > -1;

    /*
      Huawei Honor 8C:
        BKK-L21
      Huawei Honor Holly
        Hol-U19 Build/HUAWEIHol-U19
      Huawei Honor 7
        PLK-AL10 Build/HONORPLK-AL10
      Huawei Honor 4C
        CHM-U01 Build/HonorCHM-U01
      Huawei Honor 3C
        H30-T00 Build/HuaweiH30-T00
        H30-U10 Build/HuaweiH30-U10
    */
    var is_huawei_honor = /\b(HUAWEI|HONOR|BKK-L21|Hol-U19|PLK-AL10|H30-T00|H30-U10|CHM-U01)\b/i.test(ua);
    if (is_huawei_honor) {
      ShowIt.ReadyMsg( '#msg_android_huawei' );
    }

  });
</script><!-- googel anatolics -->
<!-- makros -->

<!-- Googel analytics start -->
  <script>
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

    ga('create', 'UA-1704973-1', 'auto');
    ga('send', 'pageview');
  </script>
<!-- Googel analytics end -->

<!-- Yandex.Metrika counter -->
<div style="display: none;"><script type="text/javascript" >
   (function(m,e,t,r,i,k,a){m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
   m[i].l=1*new Date();k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)})
   (window, document, "script", "https://mc.yandex.ru/metrika/tag.js", "ym");

   ym(11804806, "init", {
        clickmap:true,
        trackLinks:true,
        accurateTrackBounce:true,
        webvisor:true,
        ecommerce:"dataLayer"
   });
</script></div>
<noscript><div><img src="https://mc.yandex.ru/watch/11804806" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
<!-- /Yandex.Metrika counter --><!-- /theme/tile_mobi/cookie_accept_block.tt start -->


  <script src="https://st.drweb.com/static/js/CookiesControl.js"></script>

  <!-- Использование Cookie-файлов -->
  <div id="cookie_accept_msg_block" class="bottom left ztop space_1of1 white bg_green_3" style="position:fixed; display:none;" hidden>
    <div class="container container_cell paddYS _viewS_fontXS">
      <p class="paddXM margBS">By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. <a href="https://company.drweb.com/policy/?lng=en" class="main_green_4">Learn more</a></p>
      <p class="noMarg alignCenter -margYS -margXS">
        <button class="Btn Btn_slim bg_main_green_4" onclick="cookieMsg.set('accepted')">
          <span class="Btn-body">
            <span class="Btn-text paddXM">
              OK            </span>
          </span>
        </button>
              </p>
    </div>
  </div>

  <script>

    var cookieMsg = new CookiesControl({
      cookieName: 'SwIt_msg_cookies',
      cookieSettings: {
        expires: 10*365
      }
    });

    $(function(){

      cookieMsg
        .on( 'get', function (cookie) {
          if ( !cookie ) {
            $( 'body' ).append( $('#cookie_accept_msg_block').show() );
          }
        })
        .on( 'set', function (cookie) {
          $('#cookie_accept_msg_block').hide();
        })
        .get(); // force get callbacks

    });

  </script>

<!-- /theme/tile_mobi/cookie_accept_block.tt end --></div>



<!--TPL__GLOB__HEAD__RESOURCES is loaded; TPL__GLOB__TAIL__RESOURCES is loaded; TPL__HOST__HEAD__RESOURCES is loaded; TPL__HOST__TAIL__RESOURCES is loaded; -->

<script>document.documentElement.className += ' docReady-';</script>
</body>
</html>

